Andrew Chiles andrewchiles

name

edr-reverse-engineering

description

Standardized workflow for reverse engineering endpoint security products, including extraction, decompilation, rule and model recovery, vulnerability analysis, detection gap analysis, proof-of-concept planning, live probes, and stakeholder reports. Use when Claude is asked to analyze an endpoint detection and response product, endpoint protection agent, security sensor, antivirus engine, or similar endpoint security package from installer artifacts, extracted binaries, live systems, or prior workspace outputs.

EDR Reverse Engineering

Use this skill to run a complete, repeatable reverse-engineering workflow for endpoint security products. Apply the same structure to every product so outputs can be compared across analyses and future work can resume without rediscovery.

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

Initial Notes:

The .NET Runtime Event Provider requires setting COMPLUS_ETWEnabled=1 in your process' environment.
CLRConfig will look for configurations in the following places in the following order:
- Look at environment variables (prepending COMPlus_ to the name)
- Look at the framework registry keys (HKCU\Software\Microsoft\.NETFramework
- Look at the framework registry keys HKLM\Software\Microsoft\.NETFramework)
These can be set in the following ways:
- Setting the environment variable COMPlus_:
Windows

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	/*
	* Research by Evan McBroom and Chris Thompson (@_Mayyhem)
	* Roger Zander made security recommendations for SCCM based on the claim that NAA credentials could be recovered.
	* Source: https://rzander.azurewebsites.net/network-access-accounts-are-evil/
	* Roger stated that recover was "possible with a few lines of code" but did not provide any code. Here is working code.
	*/

	#include <Windows.h>
	#include <stdio.h>

	//Locate RPC procecures inside of server code
	//@author Matt Hand (@matterpreter) based on original work by Sektor7 Labs (@reenz0h)
	//@category Functions
	//@keybinding
	//@menupath
	//@toolbar

	import ghidra.app.script.GhidraScript;
	import ghidra.program.model.block.*;
	import ghidra.program.model.symbol.*;

	# Staged Payload Generator
	# Author: @joevest
	# Generates all stageless payload types for each current listener

	# Directory for Payloads
	mkdir("/payloads");

	println("Stageless Payload Generator");

	menubar("Stageless Payload Generator", "payloadgenerator");

	# search for and reproduce output that matches a specific regex.
	alias search {
	local('$regex $regex2 $entry $event $bid $out $when');

	# take all of the args, without processing/parsing as normal.
	if (strlen($0) > 7) {
	$regex = substr($0, 7);
	}
	else {
	berror($1, "search [regex]");

	' Need to add project references to C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscoree.tlb and mscorlib.tlb

	Private Declare PtrSafe Function DispCallFunc Lib "oleaut32.dll" (ByVal pv As LongPtr, ByVal ov As LongPtr, ByVal cc As Integer, ByVal vr As Integer, ByVal ca As Long, ByRef pr As Integer, ByRef pg As LongPtr, ByRef par As Variant) As Long
	Private Declare PtrSafe Sub RtlMoveMemory Lib "kernel32" (Dst As Any, Src As Any, ByVal BLen As LongPtr)
	Private Declare PtrSafe Function VarPtrArray Lib "VBE7" Alias "VarPtr" (ByRef Var() As Any) As LongPtr

	#If Win64 Then
	Const LS As LongPtr = 8&
	#Else
	Const LS As LongPtr = 4&

	using System;
	using System.EnterpriseServices;
	using System.Runtime.InteropServices;

	using System.Reflection;
	using System.Reflection.Emit;

	using System.Collections;
	using System.Collections.Generic;